STIGQter: STIG Summary: Oracle Linux 6 Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

The operating system must support the requirement to centrally manage the content of audit records generated by organization defined information system components.

DISA Rule

SV-219555r603263_rule

Vulnerability Number

V-219555

Group Title

SRG-OS-000342

Rule Version

OL6-00-000137

Severity

CAT II

CCI(s)

• CCI-001851 - The information system off-loads audit records per organization-defined frequency onto a different system or media than the system being audited.

Weight

10

Fix Recommendation

To configure rsyslog to send logs to a remote log server, open "/etc/rsyslog.conf" and read and understand the last section of the file, which describes the multiple directives necessary to activate remote logging. Along with these other directives, the system can be configured to forward its logs to a particular log server by adding or correcting one of the following lines, substituting "[loghost.example.com]" appropriately. The choice of protocol depends on the environment of the system; although TCP and RELP provide more reliable message delivery, they may not be supported in all environments.
To use UDP for log message delivery:

*.* @[loghost.example.com]

To use TCP for log message delivery:

*.* @@[loghost.example.com]

To use RELP for log message delivery:

*.* :omrelp:[loghost.example.com]

Check Contents

To ensure logs are sent to a remote host, examine the file "/etc/rsyslog.conf". If using UDP, a line similar to the following should be present:

*.* @[loghost.example.com]

If using TCP, a line similar to the following should be present:

*.* @@[loghost.example.com]

If using RELP, a line similar to the following should be present:

*.* :omrelp:[loghost.example.com]

If none of these are present, this is a finding.

Vulnerability Number

V-219555

Documentable

False

Rule Version

OL6-00-000137

Severity Override Guidance

To ensure logs are sent to a remote host, examine the file "/etc/rsyslog.conf". If using UDP, a line similar to the following should be present:

*.* @[loghost.example.com]

If using TCP, a line similar to the following should be present:

*.* @@[loghost.example.com]

If using RELP, a line similar to the following should be present:

*.* :omrelp:[loghost.example.com]

If none of these are present, this is a finding.

Check Content Reference

M

Target Key

2928

Comments